Privacy Policy

Account Information

When you create an account, we may collect:

• Email address
• Username or display name
• Profile photo
• Bio, job title, address, education, or work details you choose to provide

Messaging & User Content

Yonderay is a communication and collaboration platform. We collect and process content you create or share, including:

• Direct messages and team / room messages
• Message reactions
• Voice messages
• Uploaded files, attachments, images, and media
• Notes and workspace content

Content shared within conversations, teams, rooms, or workspaces may be visible to other authorized participants in those spaces.

Device & Technical Information

We may collect limited technical information automatically, including:

• Device model and operating system version
• App version, language, and region settings
• IP address
• Push notification tokens
• Connection and diagnostic logs

Billing Information

If your organization subscribes to a paid plan, we hold the records needed to run that subscription: which plan it is on, how many seats it has bought, when the period renews, and the status of its payments.

We never see or hold your card details. Payment is taken by Paddle, who act as the merchant of record — they are the seller on your invoice, they collect the payment and they handle the tax for your country. Card numbers go directly to Paddle and never reach our servers. Paddle tells us only that a subscription started, renewed, failed or ended.

Local Device Storage

Certain information may be stored locally on your device to support offline access, message caching, faster loading, notification reliability, and temporary queued message delivery.

We use information to:

• Provide messaging and collaboration features
• Authenticate users and maintain accounts
• Deliver messages, notifications, and attachments
• Improve app stability, security, and reliability
• Support offline functionality
• Prevent abuse, spam, fraud, or unauthorized access
• Respond to support requests and legal obligations

Yonderay may request the following permissions depending on the features you use:

You may deny certain permissions, but some app features may not function properly.

In transit. All data exchanged between your device and our servers travels over HTTPS (TLS), the same standard encryption used by banks and major messaging services.

At rest. Message text and note content are encrypted with AES-256-GCM before being written to our database, so the underlying storage holds ciphertext rather than readable text. Other account data and uploaded files are kept on managed cloud infrastructure that provides encryption at rest using industry-standard methods.

Operational access. Yonderay is a managed cloud service. Our backend systems process the content you send through the app in order to deliver messages, push notifications, search, and account support. Access is limited to what is necessary to operate the service, investigate abuse, and respond to your support requests.

We keep our software dependencies up to date and follow industry-standard security practices. While no method of electronic storage or transmission over the Internet can be guaranteed completely secure, we work continuously to protect your information.

We may share information only as necessary to operate the service, including with:

• Cloud hosting and infrastructure providers
• Push notification providers
• Authentication and security providers
• File storage and database providers
• Our payment provider, for organizations on a paid plan
• Legal authorities when required by law

We may use third-party cloud and infrastructure providers including services such as Cloudflare, Microsoft Azure, Firebase, or similar infrastructure services.

For paid subscriptions we share billing contact details with Paddle, our merchant of record, so that they can take payment, issue your invoice and account for tax. Paddle processes that information as a seller in their own right rather than on our behalf, under their own privacy policy.

We retain information only as long as reasonably necessary for providing the service, security and fraud prevention, legal compliance, and backup and recovery purposes.

Some deleted content may remain temporarily in backups or secure storage before permanent removal. Deleted messages may not be immediately or permanently removed from all systems.

When a subscription ends

If a paid subscription ends and is not renewed, the workspace becomes read-only. Everyone can still sign in and read everything already there; nobody can send, upload or invite. Nobody is removed from a workspace for a billing reason.

After 30 days in read-only, the workspace and everything in it is permanently deleted. We email the workspace owner before that happens. Subscribing again during those 30 days restores everything.

Records we are required to keep for tax or accounting purposes — invoices and payment records, held largely by our payment provider — are kept for as long as the law requires, separately from workspace content.

Users may request account deletion or certain data deletion requests by contacting us at [email protected]. Requests should be sent from the email address associated with the account whenever possible.

We may require reasonable verification before processing requests. Some information may be retained where required for security, fraud prevention, legal obligations, or legitimate operational purposes.

Your information may be processed and stored in countries outside your country of residence. Where required, we take reasonable steps to protect personal data transferred internationally.

Yonderay is not intended for children under 13, or the minimum age set by law in your country — whichever is higher. We do not knowingly collect personal information from children.

If you believe a child has provided personal information through the app, please contact us at [email protected] so we can take appropriate action.

Depending on your location and applicable laws, you may have rights to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Object to certain processing
• Request data portability

To exercise these rights, contact: [email protected]

Users are responsible for the content they upload, share, or transmit through Yonderay. You must not use the service to share unlawful, abusive, harmful, or infringing content.

We may remove content or restrict access where reasonably necessary to protect users, comply with law, or enforce platform safety.

Yonderay may rely on third-party infrastructure and service providers necessary to operate the app securely and reliably. These providers may process limited information required to provide hosting, storage, authentication, notifications, and related technical functionality.

Organizations on a paid plan are also served by Paddle, who act as our merchant of record and handle checkout, invoicing, payment and tax. Their handling of your billing information is governed by their own privacy policy.

We may update this Privacy Policy from time to time. Updated versions will be posted within the app, website, or app store listing with a revised effective date.

Continued use of the service after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our privacy practices, please reach out: